Bank improperly disclosed personal information; exception under section 7(3)(c) rejected

PIPEDA Case Summary #2002-96

[Principles 4.3 and 4.5 of Schedule 1; section 7(3)(c)]

Complaint

An individual complained that a bank disclosed his personal information to the lawyer of the individual's ex-spouse without his knowledge or consent.

Summary of Investigation

The lawyer of the complainant's ex-spouse subpoenaed the complainant's bank for monthly statements of credit cards that the complainant had personal or joint interest in over a period of three years. According to civil procedure in the Province of Quebec, a lawyer may issue a subpoena. In this case, the subpoena indicated that the bank could provide the documents to the lawyer or present them to the court.

The bank's policy is to prohibit disclosure of personal information unless the relevant consent is obtained or disclosure is made pursuant to a subpoena or is otherwise permitted by law. In this instance, the bank maintained that it disclosed the individual's personal information as permitted under section 7(3)(c) of the Personal Information Protection and Electronic Documents Act (the Act).

The complainant submitted that a subpoena issued by a lawyer does not meet the requirements of section 7(3)(c). The rules of civil procedure in Quebec allow lawyers to issue subpoenas without going to court; however, they do not have the authority to compel the production of records. Lawyers in Quebec are not required to notify the court prior to issuing a subpoena, nor are they required to inform the other party. The complainant maintained that the bank disclosed his personal information without informing either the court or him.

The complainant also argued that the bank was required to inform him of the subpoena and to seek his consent. If the complainant had refused, the bank would have been compelled to appear before the court so that a judge could rule on the disclosure request, thereby providing the complainant with the opportunity to present arguments against the disclosure.

The bank asserted that in divorce proceedings, both parties are required to give a complete account of their financial situations. The complainant countered that such information is not required when the ability to pay and the amount are not at issue. Information related to income is pertinent while information related to expenses is not.

The bank, however, indicated that for any subpoenas received in the future, it would provide the requested documents to the court, unless the individual's consent is obtained.

Commissioner's Findings

Issued December 3, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.5 establishes that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Section 7(3)(c) states that an organization may disclose personal information without the knowledge or consent of the individual if the disclosure is required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records.

By responding to the subpoena issued by a lawyer as provided for in the rules of civil procedure in the Province of Quebec, the bank relied on section 7(3)(c) to disclose personal information without the complainant's knowledge or consent. The Commissioner, however, determined that the lawyer did not have jurisdiction to compel the production of records. Only a court could have done so. It was also clear to the Commissioner that the records in question were not required to comply with the rules of production. In the circumstances of the divorce action, the information was not relevant.

The Commissioner found that, since the exception provided for under section 7(3)(c) did not apply, the bank had contravened Principles 4.3 and 4.5 by disclosing personal information without knowledge or consent.

He therefore concluded that the complaint was well-founded.